CVE-2026-125113

The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdXrootdXeq.cc rejects a parent-directory component only when two dots are followed by a slash and does not reject a terminal two-dot component. An unauthenticated attacker can append /.. to an exported path in xrdfs ls or an HTTP PROPFIND request, bypass the all.export directory scope, and cause directory and filename enumeration in the parent directory under oss.localroot. The demonstrated vector does not permit file download or disclose file contents. This issue is fixed in version 5.9.2.

• CWE-20
• CWE-22

• https://github.com/xrootd/xrootd/commit/0b96a52e2439aecb74f3b3eef7e782bbfaf4a64a
• https://github.com/xrootd/xrootd/releases/tag/v5.9.2
• https://github.com/xrootd/xrootd/security/advisories/GHSA-vj8v-p5vw-m6v5
• https://github.com/xrootd/xrootd/security/advisories/GHSA-vj8v-p5vw-m6v5

Published

Nov 9, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125102FFmpeg through 9.0.2 contains an uninitialized memory disclo…3.3
• CVE-2026-125103FFmpeg through 9.0.2 contains an information disclosure vuln…3.3
• CVE-2026-125104FFmpeg through 9.0.2 contains a memory exhaustion vulnerabil…5.5
• CVE-2026-125107Muhammara is a node module with c/cpp bindings to modify PDF…7.5
• CVE-2026-125109Rack is a modular Ruby web server interface. From 3.0 until …4.8
• CVE-2026-12511The AI Engine WordPress plugin before 3.5.5 does not saniti…8.1
• CVE-2026-125117Mongoose is a MongoDB object modeling tool designed to work …8.2
• CVE-2026-12512The Quotes llama WordPress plugin before 3.1.6 does not prop…8.6
• CVE-2026-125121compose-lint is a Docker Compose security linter that identi…5.3
• CVE-2026-125122compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125123compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125124compose-lint is a Docker Compose security linter that identi…2.3